2

I am trying to set up my home server to act as an OpenVPN gateway so I can connect to my VPN from any device without installing special software of them. My server is running Ubuntu 14.04.

The host has three interfaces:

  • eth0 - IP address 10.0.1.253 which is on an internal NAT'd network, and not the gateway (the gateway is 10.0.1.1, which provides the internet connection).
  • wlan0 - IP address 10.0.2.1 which is the owner/gateway of the wireless LAN I want to serve via VPN. hostapd and isc-dhcp-server are used to manage clients on this interface.
  • tun0 - IP address 10.8.8.86 which is the VPN's connection.

I do not want the server's default route to change to the VPN as there are processes that run on it that I want to allow "normal" internet access to.

I have set up a default route for a VPN network by the following commands (all commands shown are run as root via sudo):

echo "201 vpn" >> /etc/iproute2/rt_tables
ip rule add fwmark 1 table vpn
ip route add default via 10.8.8.86 table vpn
ip route flush cache

And masquerading by:

echo 1 | tee /proc/sys/net/ipv4/ip_forward
iptables -A PREROUTING -i wlan0 -t mangle \! -d 10.0.1.0/24 -j MARK --set-mark 1
iptables -t nat -A POSTROUTING -s 10.0.2.0/24 \! -d 10.0.1.0/24 -o tun0 -j MASQUERADE

I also tried adding

iptables -A FORWARD -i tun0 -j ACCEPT

but it didn't appear to make any difference.

What I am seeing is traffic being routed to the tun0 device, and masqueraded correctly, but the return information is simply disappearing, it's not being routed back to the wlan0 request.

I have run tcpdump to try and find the problem, with a sample attached. This is from requesting a web site from a device on the wlan0 network.

On the wlan0 side:

tcpdump -n -i wlan0 not port mdns
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), capture size 65535 bytes
17:54:18.703395 IP 10.0.2.2.53203 > 208.67.222.222.53: 46870+ A? www.whatismyip.com. (36)
17:54:19.706732 IP 10.0.2.2.53203 > 208.67.222.222.53: 46870+ A? www.whatismyip.com. (36)
17:54:22.714178 IP 10.0.2.2.53203 > 8.8.4.4.53: 46870+ A? www.whatismyip.com. (36)
17:54:23.717681 IP 10.0.2.2.53203 > 8.8.4.4.53: 46870+ A? www.whatismyip.com. (36)
17:54:26.725358 IP 10.0.2.2.53203 > 208.67.222.222.53: 46870+ A? www.whatismyip.com. (36)
17:54:32.081146 ARP, Request who-has 10.0.2.1 tell 10.0.2.2, length 28
17:54:32.081192 ARP, Reply 10.0.2.1 is-at 80:1f:02:49:47:a0, length 28
17:54:35.744061 IP 10.0.2.2.53203 > 208.67.222.222.53: 46870+ A? www.whatismyip.com. (36)

Where the DNS requests are visible, but no responses.

On the tun0 side:

tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
17:54:18.703494 IP 10.8.8.86.53203 > resolver1.opendns.com.domain: 46870+ A? www.whatismyip.com. (36)
17:54:19.011244 IP resolver1.opendns.com.domain > 10.8.8.86.53203: 46870 2/0/0 A 141.101.120.15, A 141.101.120.14 (68)
17:54:19.706815 IP 10.8.8.86.53203 > resolver1.opendns.com.domain: 46870+ A? www.whatismyip.com. (36)
17:54:20.009089 IP resolver1.opendns.com.domain > 10.8.8.86.53203: 46870 2/0/0 A 141.101.120.14, A 141.101.120.15 (68)
17:54:22.714279 IP 10.8.8.86.53203 > google-public-dns-b.google.com.domain: 46870+ A? www.whatismyip.com. (36)
17:54:23.075728 IP google-public-dns-b.google.com.domain > 10.8.8.86.53203: 46870 2/0/0 A 141.101.120.15, A 141.101.120.14 (68)
17:54:23.717755 IP 10.8.8.86.53203 > google-public-dns-b.google.com.domain: 46870+ A? www.whatismyip.com. (36)
17:54:24.059747 IP google-public-dns-b.google.com.domain > 10.8.8.86.53203: 46870 2/0/0 A 141.101.120.15, A 141.101.120.14 (68)
17:54:26.725404 IP 10.8.8.86.53203 > resolver1.opendns.com.domain: 46870+ A? www.whatismyip.com. (36)
17:54:35.744099 IP 10.8.8.86.53203 > resolver1.opendns.com.domain: 46870+ A? www.whatismyip.com. (36)
17:54:36.046371 IP resolver1.opendns.com.domain > 10.8.8.86.53203: 46870 2/0/0 A 141.101.120.14, A 141.101.120.15 (68)

Which shows that the DNS responses are coming back from the VPN connection.

Any suggestions as to what I have missed?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.